Authors a governance policy.

POST

/v1/m/governance/policies

curl --request POST \
  --url https://example.com/v1/m/governance/policies \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "enabled": true, "kind": "abac", "name": "example", "spec": { "rules": [ { "deny": true, "min_aal": 1, "permission": "example", "principal_kind": "", "resource": "example", "verb": "" } ] } }'

• this engine

Authors a governance policy. Admin-tier and self-audited; the ABAC cache is invalidated AFTER the write commits.

Authorizations

• bearerAuth

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

One of:

object

object

enabled

boolean

kind

required

Allowed value: abac

name

required

string

>= 1 characters

spec

required

object

rules

required

Array<object>

>= 1 items <= 64 items

Any of:

object

object

deny

required

boolean

min_aal

integer

<= 3

permission

required

string

>= 1 characters

principal_kind

string

Allowed values: "" user token

resource

string

<= 128 characters

verb

string

Allowed values: "" read write admin

object

object

deny

required

boolean

min_aal

integer

<= 3

permission

string

<= 128 characters

principal_kind

string

Allowed values: "" user token

resource

string

<= 128 characters

verb

required

Allowed values: read write admin

object

object

deny

required

boolean

min_aal

integer

<= 3

permission

string

<= 128 characters

principal_kind

string

Allowed values: "" user token

resource

required

string

>= 1 characters

verb

string

Allowed values: "" read write admin

object

object

deny

required

boolean

min_aal

integer

<= 3

permission

string

<= 128 characters

principal_kind

required

Allowed values: user token

resource

string

<= 128 characters

verb

string

Allowed values: "" read write admin

object

object

deny

required

boolean

min_aal

required

integer

>= 1

permission

string

<= 128 characters

principal_kind

string

Allowed values: "" user token

resource

string

<= 128 characters

verb

string

Allowed values: "" read write admin

object

object

enabled

boolean

kind

required

Allowed value: approval

name

required

string

>= 1 characters

spec

Any of:

object

object

escalate_in_seconds

integer format: int64

<= 31536000

expires_in_seconds

integer format: int64

<= 31536000

match

object

action

string

<= 128 characters

subject_kind

string

<= 128 characters

required_approvals

integer

<= 64

risk_tier

string

Allowed values: "" low medium high critical

null

null

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}